CVE-2026-46364
Fixed upstream EPSS 2%CVSS 9.8
phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods that interpolate unsanitized User-Agent headers into DELETE and INSERT queries. Unauthenticated attackers can exploit the public GET /api/captcha endpoint by crafting malicious User-Agent headers to perform time-based blind SQL injection, extracting sensitive data including user credentials, admin tokens, and SMTP credentials from the database.
Products: thorsten phpmyfaq
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Packagist | phpmyfaq/phpmyfaq | 4.1.2 |
| Packagist | thorsten/phpmyfaq | 4.1.2 |